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(54) Network management event correlation in environments containing inoperative network 
elements 



(57) A network monitor (510) for distinguishing 
between broken and inaccessible network elements 
(124, 128-136). The network monitor includes one or 
more computer readable storage mediums, and compu- 
ter readable program code stored in the one or more 
computer readable storage mediums. The computer 
readable program code includes code for discovering 
the topology of a plurality of network elements, code for 
periodically polling a plurality of network interfaces 
associated with the plurality of network elements, code 
for computing or validating a critical Route attribute for 
each of the plurality of network interfaces, and code for 
analyzing a status of network interfaces identified by the 
criticalRoute attribute of an interface in question (HQ) 
which is not responding to a poll or ping. The computer 
readable program code may also include code for 
establishing a slowPingList and placing in-memory rep- 
resentations of broken or failed network interfaces ther- 
eon, thereby reducing the amount of information which 
is presented to a network administrator from inaccessi- 
ble elements not responding to a network interface poll. 
A means for correlating and/or suppressing events 
(502) in response to the determination of whether a net- 
work interface is failed or broken is also provided. Infor- 
mation which is not critical to a network administrator 
may be suppressed, and then viewed in a "drill down" 



(522, 722, 822) of a particular network interface. 
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